CVEs published June 26, 2025
116 CVEs were published on June 26, 2025: 16 critical, 29 high.
- Published
- 116
- Critical
- 16
- High
- 29
- Medium
- 64
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 41
Most affected products
- LabRedesCefetRJ WeGIA
- 6
- GitLab
- 5
- MongoDB Server
- 4
- filebrowser · github.com/filebrowser/filebrowser/v2 +1
- 3
- Trellix System Information Reporter
- 3
- UTT HiPER
- 3
- Canonical cloud-init
- 2
- iroha Soft Co. iroha Board
- 2
- juzaweb CMS · juzaweb/cms
- 2
- ManageEngine Exchange Reporter Plus
- 2
Critical 16
- CVE-2025-3699Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation G-50 all versions, G-50-W all versions, G-50A Mitsubishi Electric G-50 · Mitsubishi Electric G-50-W +25
- CVE-2015-0843yubiserver before 0.6 is prone to buffer overflows due to misuse of sprintf.yubiserver
- CVE-2015-0842yubiserver before 0.6 is prone to SQL injection issues, potentially leading to an authentication bypass.yubiserver
- CVE-2014-7210pdns specific as packaged in Debian in version before 3.3.1-1 creates a too privileged MySQL user.Debian pdns
- CVE-2014-0468Vulnerability in fusionforge in the shipped Apache configuration, where the web server may execute scripts that the users would have uploadfusionforge
- CVE-2025-34049OptiLink ONT1GEW GPON Remote Code ExecutionOptiLink ONT1GEW GPON
- CVE-2025-34046Fanwei E-Office Unauthenticated File UploadShanghai Fanwei Network Technology E-Office
- CVE-2025-34044WIFISKY 7-Layer Flow Control Router Remote Command ExecutionShenzhen Lingkong Technology WIFISKY 7-layer flow control r…
- CVE-2025-34043Vacron NVR Remote Command ExecutionVacron Network Video Recorder
- CVE-2025-34042Beward N100 IP Camera Remote Command ExecutionBeward N100 IP Camera
- CVE-2025-6561Hunt Electronic Hybrid DVR - Exposure of Sensitive System InformationHunt Electronic HBF-09KD · Hunt Electronic HBF-16NK
- CVE-2025-4334Simple User Registration <= 6.3 - Unauthenticated Privilege Escalationnmedia Simple User Registration
- CVE-2024-52928Arc before 1.26.1 on Windows has a bypass issue in the site settings that allows websites (with previously granted permissions) to add new p
- CVE-2025-29331An issue in MHSanaei 3x-ui before v.2.5.3 and before allows a remote attacker to execute arbitrary code via the management script x-ui passe
- CVE-2025-30131An issue was discovered on IROAD Dashcam FX2 devices.
- CVE-2025-49603Northern.tech Mender Server before 3.7.11 and 4.x before 4.0.1 has Incorrect Access Control.
High 29
- CVE-2025-6734UTT HiPER 840G API formP2PLimitConfig sub_484E40 buffer overflowUTT HiPER
- CVE-2025-6733UTT HiPER 840G API formConfigDnsFilterGlobal sub_416928 buffer overflowUTT HiPER
- CVE-2025-6732UTT HiPER 840G API setSysAdm strcpy buffer overflowUTT HiPER
- CVE-2014-6274S3 and Glacier remotes creds embedded in the git repo were not encryptedgit-annex
- CVE-2025-52904File Browser: Command Execution not Limited to Scopefilebrowser · github.com/filebrowser/filebrowser/v2 +1
- CVE-2025-52903File Browser Allows Execution of Shell Commands That Can Spawn Other Commandsfilebrowser · github.com/filebrowser/filebrowser +1
- CVE-2025-52477Octo-STS Vulnerable to Unauthenticated SSRF with HTTP Response Reflection in OIDC Flowocto-sts app · github.com/octo-sts/app
- CVE-2025-34047Leadsec VPN Path Traversal Arbitrary File ReadBeijing NetGuard Nebula Information Technology Co. Leadsec…
- CVE-2025-34048D-Link DSL-2730U/2750U/2750E Path Traversal Arbitrary File ReadD-Link DSL-2730U · D-Link DSL-2750U +1
- CVE-2025-34045WeiPHP Path Traversal Arbitrary File ReadShenzhen Yuanmengyun Technology Co. WeiPHP
- CVE-2025-53007arduino-esp32 vulnerable to CRLF injection in WebServer.cppespressif arduino-esp32
- CVE-2025-53002LLaMA-Factory Remote Code Execution (RCE) Vulnerabilityhiyouga LLaMA-Factory · llamafactory
- CVE-2025-52902File Browser has Stored Cross-Site Scripting vulnerabilityfilebrowser · github.com/filebrowser/filebrowser/v2 +1
- CVE-2025-52887cpp-httplib has unlimited number of http header fields, which causes memory leakyhirose cpp-httplib
- CVE-2025-6710Pre-authentication Denial of Service Stack Overflow Vulnerability in JSON Parsing via Excessive Recursion in MongoDBMongoDB Server
- CVE-2025-6709Pre-Authentication Denial of Service Vulnerability in MongoDB Server's OIDC AuthenticationMongoDB Server
- CVE-2025-49003Dataease H2 JDBC Connection Remote Code Executiondataease
- CVE-2025-48921Open Social - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-079Drupal Open Social
- CVE-2025-6693RT-Thread device.c sys_device_write memory corruptionRT-Thread
- CVE-2025-5966Stored XSSManageEngine Exchange Reporter Plus
- CVE-2025-5366Stored XSSManageEngine Exchange Reporter Plus
- CVE-2025-6562Hunt Electronic Hybrid DVR - OS Command InjectionHunt Electronic Hybrid DVR
- CVE-2025-3771A path or symbolic link manipulation vulnerability in SIR 1.0.3 and prior versions allows an authenticated non-admin local user to overwriteTrellix System Information Reporter
- CVE-2025-6212Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database modulethemefic Ultra Addons for Contact Form
- CVE-2024-6174When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address.Canonical cloud-init
- CVE-2025-5459OS Command InjectionPerforce Puppet Enterprise
- CVE-2025-37101HPE OneView for VMware vCenter (OV4VC), Local Elevation of PrivilegeHewlett Packard Enterprise HPE OneView for VMware vCenter
- CVE-2025-5590Owl carousel responsive <= 1.9 - Authenticated (Contributor+) SQL Injection via id Parametergopiplus Owl carousel responsive
- CVE-2025-51672A time-based blind SQL injection vulnerability was identified in the PHPGurukul Dairy Farm Shop Management System 1.3.
Medium, low and unrated 71
- CVE-2025-6736juzaweb CMS Add New Themes Page install improper authorizationjuzaweb CMS · juzaweb/cms
- CVE-2025-6735juzaweb CMS Import Page imports improper authorizationjuzaweb CMS · juzaweb/cms
- CVE-2025-6731yzcheng90 X-SpringBoot APK File apk uploadApk path traversalyzcheng90 X-SpringBoot
- CVE-2025-5731Infinispan: credential leakage in infinispan cliRed Hat infinispan · Red Hat Data Grid +2
- CVE-2015-0849pycode-browser before version 1.0 is prone to a predictable temporary file vulnerability.pycode-browser
- CVE-2025-52555CephFS Permission Escalation Vulnerability in Ceph Fuse mounted FSceph
- CVE-2013-1424Buffer overflow vulnerability in matplotlib.This issue affects matplotlib: before upstream commit ba4016014cb4fb4927e36ce8ea429fed47dcb787.matplotlib
- CVE-2025-53122SQLi in OpenNMS Horizon and MeridianThe OpenNMS Group Horizon · The OpenNMS Group Meridian
- CVE-2025-49592n8n Login Flow has Open Redirect Vulnerabilityn8n-io n8n · n8n
- CVE-2025-5995Canon EOS Webcam Utility Pro for MAC OS contains an insecure permission issue potentially leading to code execution and privilege escalationCanon USA Canon EOS Webcam Utility Pro
- CVE-2025-53121Stored XSS in multiple 33.0.8files in opennms/opennmsThe OpenNMS Group Horizon · The OpenNMS Group Meridian
- CVE-2025-53013Himmelblau offline auth permits authentication with invalid Hello PINhimmelblau-idm himmelblau
- CVE-2025-6702linlinjava litemall post improper authorizationlinlinjava litemall
- CVE-2025-6701Xuxueli xxl-sso doLogin redirectXuxueli xxl-sso · com.xuxueli:xxl-sso
- CVE-2025-6700Xuxueli xxl-sso login cross site scriptingXuxueli xxl-sso · com.xuxueli:xxl-sso
- CVE-2025-6699LabRedesCefetRJ WeGIA Cadastro de Funcionário cadastro_funcionario.php cross site scriptingLabRedesCefetRJ WeGIA
- CVE-2025-36034IBM InfoSphere DataStage Flow Designer information disclosureIBM InfoSphere Information Server
- CVE-2025-6698LabRedesCefetRJ WeGIA Adicionar tipo adicionar_tipoSaida.php cross site scriptingLabRedesCefetRJ WeGIA
- CVE-2025-6697LabRedesCefetRJ WeGIA Adicionar tipo adicionar_tipoEntrada.php cross site scriptingLabRedesCefetRJ WeGIA
- CVE-2025-52900File Browser has Insecure File Permissionsfilebrowser · github.com/filebrowser/filebrowser/v2 +1
- CVE-2025-6696LabRedesCefetRJ WeGIA Cadastro de Atendio Cadastro_Atendido.php cross site scriptingLabRedesCefetRJ WeGIA
- CVE-2025-52573Command Injection in MCP Server ios-simulator-mcpjoshuayoes ios-simulator-mcp · ios-simulator-mcp
- CVE-2025-6707Race condition in privilege cache invalidation cycleMongoDB Server
- CVE-2025-6706Running certain aggregation operations with the SBE engine may lead to unexpected behavior on MongoDB ServerMongoDB Server
- CVE-2025-6677Paragraphs table - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-084Drupal Paragraphs table · drupal/paragraphs_table
- CVE-2025-6676Simple XML sitemap - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-083Drupal Simple XML sitemap · drupal/simple_sitemap
- CVE-2025-6675Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-082Enterprise MFA - TFA for Drupal · drupal/miniorange_2fa
- CVE-2025-6674CKEditor5 Youtube - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-081Drupal CKEditor5 Youtube · drupal/ckeditor5_youtube
- CVE-2025-5682Klaro Cookie & Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-080Drupal Klaro Cookie & Consent Management · drupal/klaro
- CVE-2025-48922GLightbox - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-078Drupal GLightbox · drupal/glightbox
- CVE-2025-48923Toc.js - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-077Drupal Toc.js · drupal/toc_js
- CVE-2025-6695LabRedesCefetRJ WeGIA Additional Categoria adicionar_categoria.php cross site scriptingLabRedesCefetRJ WeGIA
- CVE-2025-6694LabRedesCefetRJ WeGIA Adicionar Unidade adicionar_unidade.php cross site scriptingLabRedesCefetRJ WeGIA
- CVE-2025-3773A sensitive information exposure vulnerability in System Information Reporter (SIR) 1.0.3 and prior allows an authenticated non-admin localTrellix System Information Reporter
- CVE-2025-3722A path traversal vulnerability in System Information Reporter (SIR) 1.0.3 and prior allowed an authenticated high privileged user to issue Trellix System Information Reporter
- CVE-2025-6703transport/fc.rs: panic attempting to send MAX_DATA with value larger max varintMozilla neqo
- CVE-2024-11584cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, Canonical cloud-init
- CVE-2025-5338Royal Elementor Addons <= 1.7.1028 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple Widgetswproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2025-5842Modern Design Library <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameterbutterflymedia Modern Design Library
- CVE-2025-48497Cross-site request forgery vulnerability exists in iroha Board versions v0.10.12 and earlier.iroha Soft Co. iroha Board
- CVE-2025-41404Direct request ('Forced Browsing') issue exists in iroha Board versions v0.10.12 and earlier.iroha Soft Co. iroha Board
- CVE-2025-1754Missing Authentication for Critical Function in GitLabGitLab
- CVE-2025-2938Business Logic Errors in GitLabGitLab
- CVE-2025-3279Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2025-5315Missing Authorization in GitLabGitLab
- CVE-2025-5846Missing Authorization in GitLabGitLab
- CVE-2025-6624Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debugsnyk · github.com/snyk/go-application-framework
- CVE-2025-6540web-cam <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via slug Parametermurtuzamakda52 web-cam
- CVE-2025-5813Amazon Products to WooCommerce <= 1.2.7 - Missing Authorization to Unauthenticated Arbitrary Product Creationsuhailahmad64 Amazon Products to WooCommerce
- CVE-2025-6546Drive Folder Embedder <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via tablecssclass Parameterazumbro Drive Folder Embedder
- CVE-2025-5275Charitable <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settingssmub Charitable – Donation Plugin for WordPress – Fundraisi…
- CVE-2025-6537Namasha By Mdesign <= 1.2.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via playicon_title Parametermdesignfa Namasha By Mdesign
- CVE-2025-5932Homerunner <= 1.0.30 - Cross-Site Request Forgery to Settings Updatecoolrunner Homerunner
- CVE-2025-5929The Countdown <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via clientId Parameterzourbuth The Countdown – Block Countdown Timer
- CVE-2025-5559TimeZoneCalculator <= 3.37 - Authenticated (Contributor+) Stored Cross-Site Scriptingneoxx TimeZoneCalculator
- CVE-2025-5540Event RSVP and Simple Event Management Plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingemarket-design Event RSVP and Simple Event Management Plugin
- CVE-2025-6258WP SoundSystem <= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsstm-track Shortcodegrosbouff WP SoundSystem
- CVE-2025-5564GC Social wall <= 1.15 - Authenticated (Contributor+) Stored Cross-Site Scriptinggurievcreative GC Social Wall
- CVE-2025-6383WP-PhotoNav <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photonav Shortcodefmos WP-PhotoNav
- CVE-2025-6290Tournament Bracket Generator <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via bracket Shortcodeblakelong Tournament Bracket Generator
- CVE-2025-5812VG WORT METIS <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Updatevgwort VG WORT METIS
- CVE-2025-6378Responsive Food and Drink Menu <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_pdf_menus Shortcodecorporatezen222 Responsive Food and Drink Menu
- CVE-2025-6538Post Rating and Review <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameterbourgesloic Post Rating and Review
- CVE-2025-3863Post Carousel Slider for Elementor <= 1.6.0 - Authenticated (Subscriber+) Missing Authorization via process_wbelps_promo_form Functionplugindevs Post Carousel Slider for Elementor
- CVE-2025-5488WP Masonry & Infinite Scroll <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingkaushik07 WP Masonry & Infinite Scroll
- CVE-2025-5535e.nigma buttons <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingchemiker e.nigma buttons
- CVE-2025-5588Image Editor by Pixo <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via download Parameterickata Image Editor by Pixo
- CVE-2024-56915Netbox Community v4.1.7 and fixed in v.4.2.2 is vulnerable to Cross Site Scripting (XSS) via the RSS feed widget.
- CVE-2025-44141A Cross-Site Scripting (XSS) vulnerability exists in the node creation form of Backdrop CMS 1.30.
- CVE-2025-50350PHPGurukul Pre-School Enrollment System Project v1.0 is vulnerable to Directory Traversal in manage-classes.php.
- CVE-2025-51671A SQL injection vulnerability was discovered in the PHPGurukul Dairy Farm Shop Management System 1.3.